Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
paymentrequest.py in Electrum before 4.2.2 allows a file:// URL in the r parameter of a payment request (e.g., within QR code data). On Windows, this can lead to capture of credentials over SMB. On Linux and UNIX, it can lead to a denial of service by specifying the /dev/zero filename.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Electrum 参数注入漏洞
Vulnerability Description
Electrum是电子比特币钱包。 Electrum 4.2.2 之前版本存在安全漏洞，该漏洞源于 paymentrequest.py 允许在支付请求的 r 参数中使用文件协议URL（file://）。在 Windows 上，这可能会导致通过 SMB 捕获凭据。 在 Linux 和 UNIX 上，通过指定 /dev/zero 文件名可能导致拒绝服务。
CVSS Information
N/A
Vulnerability Type
N/A